Not using "secret", what are the issues?

[mbellot]

I finally managed to get my Cisco 1750 working with PIAF, but the SIP implementation does not support standard SIP authentication (go figure).

As a result, I have two extensions that are configured with the "secret" field left blank in FreePBX (and it warns me every time).

The 1750 is on a static (private, 192.168.x.x) IP which is specified in the host field, and I have set qualify to yes as well.

Does specifying the address in the host field "lock" the extension to that one IP address so that the extension is somewhat secure?

Is there anything else I can do to further secure the extension from undesired use?

Thanks!

 

[tshif]

mbellot -

You probably want to use the permit field in the extension screen. The PBX willonly accept registrations for that extension from the IP address or range you define.

Is your server on a public IP or private? Not that it makes much difference - just curious.

 

[mbellot]

Everything is on a private network, there is a router/firewall that is forwarding traffic from the outside world to the PIAF server.

I'll look into the permit field.

Thanks!

 

[blanchae]

Even if you are behind a firewall, that is marginal security. If someone sniffs the network (sees some traffic on the outside), finds the extension number then you could be looking at a $50,000 telephone bill/month.

Take a gander at SipViscous' site and watch this video that shows you how easy it is to hack a VoIP network..